--- /usr/sbin/pam-auth-update.orig      2014-11-11 20:16:54.000000000 +0100
+++ /usr/sbin/pam-auth-update   2015-08-20 17:35:27.748609537 +0200
@@ -670,24 +670,27 @@
 {
        my ($profile) = $_[0];
        my $fieldname;
+       my $fieldvalue;
        my %profile;
        open(PROFILE, $profile) || die "could not read profile $profile: $!";
        while (<PROFILE>) {
                if (/^(\S+):\s+(.*)$/) {
                        $fieldname = $1;
+                       $fieldvalue = $2;
+                       $fieldvalue =~ s/^\s+|\s+$//;
                        # compatibility with the first implementation round;
                        # "Auth-Final" is now just called "Auth"
                        $fieldname =~ s/-Final$//;
                        if ($fieldname eq 'Conflicts') {
-                               foreach my $elem (split(/, /, $2)) {
+                               foreach my $elem (split(/, /, $fieldvalue)) {
                                        $profile{'Conflicts'}->{$elem} = 1;
                                }
                        } else {
-                               $profile{$fieldname} = $2;
+                               $profile{$fieldname} = $fieldvalue;
                        }
                } else {
                        chomp;
-                       s/^\s+//;
+                       s/^\s+|\s+$//;
                        $profile{$fieldname} .= "\n$_" if ($_);
                        $profile{$fieldname} =~ s/^[\n\s]+//;
                }